Email posture for any domain: can it receive mail, can it be spoofed? MX, SPF and DMARC.
Scored across 4 tools
Each tool has a clear, distinct target: one aggregate posture check and three individual record lookups. The combined tool explicitly tells agents to prefer it unless they know which specific record they need, which prevents misselection.
The three record-specific tools follow a consistent get_<record>_record(s) pattern, but check_email_domain uses a different verb and object structure. This is a minor deviation that still reads predictably because check_ signals the aggregate overview.
Four tools is a well-scoped set for an email-checking server: one combined high-level check and three focused lookups. Each tool earns its place without redundancy or bloat.
The toolset covers the core email deliverability and spoofing checks: MX, SPF, DMARC, and a combined posture check. However, it lacks DKIM, which is often relevant to DMARC-based email authentication and slightly undermines the 'full email posture' claim.
Full email posture for a domain: can it receive mail, and can it be spoofed?
Runs MX, SPF and DMARC lookups together and returns a plain-language verdict alongside the raw records: can_receive_mail, spoofable, and a list of specific findings. Use this as the default check before emailing an unfamiliar domain, when judging whether inbound mail claiming to be from a domain could be forged, or when auditing your own domains. Prefer this over the single-record tools unless you already know which record you need.
Inputs: domain (required). Returns: mx, spf, dmarc, domain, +5 more
DMARC record, policy, and whether it actually protects.
Returns the DMARC TXT record at _dmarc., its policy (none / quarantine / reject), the percentage it applies to, and whether that policy protects against spoofing. Also flags the case of MULTIPLE DMARC records, which RFC 7489 requires receivers to treat as no policy at all — a domain in that state is unprotected however strict its records look. A policy of "none" is monitoring only and does not stop forged mail. Use when assessing whether mail claiming to be from a domain can be trusted.
Inputs: domain (required). Returns: found, domain, policy, record, +5 more
Mail exchanger records for a domain.
Returns the MX hosts in priority order and whether any exist. A domain with no MX records cannot receive mail, so sending to it will bounce. Use when you only need deliverability and not spoofing posture; use check_email_domain for the full picture.
Inputs: domain (required). Returns: found, hosts, domain, can_receive_mail
SPF record and how strict it is.
Returns the SPF TXT record, the qualifier on its all mechanism (fail / softfail / neutral / pass) and what that means in practice, plus whether more than one SPF record exists — which receivers treat as an error, leaving the domain unprotected. Use when diagnosing why mail from a domain is being rejected or marked.
Inputs: domain (required). Returns: found, domain, record, strict, +3 more
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Check if a domain can be email-spoofed: SPF, DMARC, DKIM, MX graded from public DNS. Authless.
Check SPF, DKIM, DMARC and MX of any domain, and read the DMARC reports of domains you monitor.
Assess any domain's email security across SPF, DMARC, DKIM, MTA-STS, DNSSEC, DANE, and TLS-RPT.
Check a domain's email authentication: SPF, DKIM, DMARC, BIMI, MX, MTA-STS, TLS-RPT. Score + fixes.
Add one secure layer between your agents and this server.